CaseVegas Walkthrough — Cyberdefenders
Challenge: CaseVegas
Tools/Techniques:
- Google Dork
- Google Street View
- VLC
Set-up:
I first converted the provided video into images using VLC. You can watch this video from youtube on how to convert a video into images. Watch here. I set the recording ratio to 1000.
Computation:
This formula/computation helps me determine the time when the image was captured from the video.
30 fps — You can check the fps by right-clicking the video and navigating to Properties > Details > Frame rate
37mins = 2220s + 3s = 2223s — The footage is 37:03 long (I converted 37:03 into seconds)
1000 ratio — the recording ratio I set in VLC.
The total number of screenshots I should get is 67.
2223 * 30 = 66,690
66,690 / 1000 = 66.69 or 67 screenshots
If you count the images above, it’s 67 images.
If you notice, the naming convention is increasing every 1000 (scene00001, scene01001, scene02001, etc.). This is because I set the recording ratio to 1000, and it takes a screenshot every 1000 frames.
I will use scene41001.png to find the time when it was captured from the video.
frame = 41000 (check the filename to get the frame)
fps = 30
60 seconds = 1 minute
41000f / 30fps = 1366.67s
1366.67s / 60s = 22.78 minutes
(So this is where I can use my 10+ Mathematics subjects in College huh! 😆)
- File->Vehicle-number.png:
At which minute of the video was the vehicle observed?
I checked all the screenshots and found that the vehicle was captured with a filename scene64001.png
Using the formula above, I calculated the result to be 35.55 minutes. I then fast-forwarded the video until it reached the 35-minute mark. As shown in the image below, the vehicle was observed around 35 minutes.
2. File->Vehicle-number.png:
What is the zip code of the place where the vehicle was observed in the video?
Since I already knew when the vehicle was captured from the video, I looked for signs in nearby establishments. I found the avenue when the car was observed and it was “E Ogden Ave”. I googled using the string below and found the zip code.
E Ogden Ave Las Vegas3. File->Chapel:
This chapel has a live webcam. What is the name of the chapel?
I uploaded the image to 4 different search engines (Google, Yandex, Bing, & Baidu) but unfortunately, all the results are different from the provided image.
Then I checked all the screenshots from VLC and found the chapel with filename scene49001.png.
4. File->Chapel:
What strip hotel does the chapel have a view of?
Since I now know the chapel’s name, I used google street view to look at nearby establishments. Based on the image below, we can now identify the hotel’s name.
5. What date did the Mandalay Bay shooting take place?
I used the operator “” to search for any news regarding this incident using the string Mandalay Bay Shooting and I found the date when the incident took place on Wikipedia.
6. On 30/09/2017 at 14:47, Stephen Paddock was seen on CCTV footage. Where was he?
I searched for the full CCTV footage on youtube and found this 1hr long video. I fast-forwarded the video until it reached the provided time.
The image above shows where Stephen Paddock at 14:48:20, just 1 minute ahead of the provided time.
7. File->Vehicle.png:
This vehicle may be related to our investigation. What place did it go to?
I checked the screenshots and found the vehicle with the filename scene54001.png. I calculated the time and got 30 minutes.
I then fast-forwarded the video until it reached 30 minutes.
The image is not exactly the same since I rounded up the fps, but you can still see the vehicle at the 30-minute mark.
At 30:56 in the video, the exact location where the vehicle went can be seen.
8. Find MGM financial report in the form of a PDF document (not website) which contains the words:
‘Consolidated net revenues increased 13% compared to the prior-year quarter to $3.2 billion’
Submit the URL as an answer.
I used the “intext:” and “filetype:” filters to highlight the strings and display all PDF files related to the strings from “intext:”.
intext: Consolidated net revenues increased 13% compared to the prior-year quarter to $3.2 billion' Submit the URL as an answer filetype:pdfThe filter above produces the following output:
9. File->Number:
What is the complete number?
I checked all the screenshots and found the image with the filename scene60001.png. The image captured is missing 4 digits.
Since the image above provided the Avenue, I searched for it using Google Street View.
Unfortunately, the number posted now is different from the provided image. (January 2021).
The good thing is that Google Street View has a feature similar to the Wayback Machine, which allows you to change the date and view the exact image captured on that date.
I set it to Jun 2017 and found the complete number.
10. File->Number:
Who is the number’s owner?
I used phoneinfoga first but did not find the number’s owner.
Then I used the “” operator and intext: filter.
"7027355700" intext:las vegasThe filter above produces the following result:
11. What is New York-New York?
I searched New York-New York and opened the first result, then compared the image captured from the video.
Based on the image above, we can now determine what New york-New york is.
12. In 2018, a famous hacking conference was held in Las Vegas. Who was the keynote speaker?
After reading the question, the things that come to my mind are DEFCON and BlackHat.
I searched defcon26 first and it gave me 6 speakers. Then I searched for Blackhat USA 2018 using the filter below and found the Keynote speaker.
blackhat USA 2018 Las Vegas keynote site:twitter.com13. File->Devil.png:
What does this belong to? The Devil is in the detail. Provide the tower name.
I checked all the screenshots and found scene62001.png captured the tower.
I used the formula in the Computation section and got around 34 minutes.
I played the video until I got a close view of the building and found the building’s website.
From the website below, we can now determine the tower name of Devil.png.
14. At which minute of the video was The Deuce (Las Vegas bus) observed?
From the previous question, the bus was seen in image scene62001.png. I calculated the time, and I got around 34 minutes.
15. File->Location:
What does this belong to?
I checked all the screenshots and found 1 building with the same stripe as the image above.
I computed the time, and I got around 25 minutes.
I searched the posted sign “stratosphere ” using intext: filter.
intext:stratosphere las vegasThe filter above produces the following output:
16. The sign at 36.131749, -115.164647 is advertising what show?
Since the question provided the coordinates, I used google street view to determine where the place was.
I checked all the screenshots and found the place in the image scene38001.png
I computed the time and got 21.11 minutes. Then, I fast-forwarded the video until it reached 21 minutes and found the ads.
17. Files->Person-2:
At which minute of the video did you see this person?
I checked all the screenshots and found where the person was standing.
I computed the time using the formula above, and I got 11.11 minutes. I fast-forwarded the video until it reached 11 minutes and found the Person.
18. Facebook ID 250240925003365 is linked to a criminal group. What are they called?
Since the question already provided the Facebook ID, I used it to search for the criminal group.
www.facebook.com/250240925003365The URL above produces the following output:
References:
